I’ll defend this practice. It’s the only way of knowing for sure that you’re transmitting exactly the information you intend to send. Even copy/paste often picks up other stuff you don’t intend.
It's more of a way to prevent transmitting any easily accessible data at all. Using a human-auditable but still machine-readable format like CSV is what should be done.
Having a data review process with automated integrity, confidentiality, and quality checks is not terribly difficult.
But having a prototocol to export the pdf to csv is also dead easy for confirming only the data relevant is included. ASCII is just as “easy” as scan, but it requires training clerks to be data-oriented rather than document.
_ugh_ if only CSVs were standardized sooner and more completely. There are many encoding, delimiter, escaping and truncation conventions to deal with in real world data.
There are other ways to ensure this. Even with your own logic, it would make sense then to send both the Excel sheets and scanned PDFs of the Excel sheets, isn't it? It would be super comical though